AWS security audit
A read-only review of your AWS organization against the CIS AWS Foundations Benchmark, followed by the manual work a benchmark cannot do: tracing who can reach what, and how far an attacker could get from one leaked key.
Who it is for
- Companies running production on AWS without an independent security review.
- AWS Organizations with many accounts grown by different teams.
- Teams preparing for SOC 2 or ISO 27001 with AWS in scope.
What we assess
- AWS Organizations, service control policies and how accounts are separated.
- IAM: root account protection, long-lived access keys, overly broad policies and privilege escalation paths such as iam:PassRole.
- S3: Block Public Access settings, bucket policies and shared objects.
- Security groups and network ACLs open to the internet, and EC2 instance metadata (IMDSv2) enforcement.
- CloudTrail, AWS Config, GuardDuty and Security Hub coverage across every region.
- KMS keys, rotation, and encryption of storage and databases.
What you receive
- CIS AWS Foundations Benchmark results, reviewed by hand.
- Findings that name the exact policy, setting or account to change.
- An account-by-account summary for organizations with many accounts.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two weeks for an organization of up to ten accounts.
Common questions
What access do you need?
The AWS managed policies SecurityAudit and ViewOnlyAccess on a role you create, in each account or through your organization. Nothing that can change resources.
Do you look at every region?
Yes. Unused regions are a common blind spot: logging or threat detection switched off where nobody is looking.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
AWS security audit
We reply within one business day.
Nothing you send is shared outside Calibre.